EDPB – Court Ruling (European Union, 2025)

In 2018 three data subjects, from Belgium, Germany and Austria respectively filed complaints with the DPAs in their home countries. The data subjects were represented by noyb - European Center for Digital Rights. The complaints were filed against Facebook Ireland Ltd and WhatsApp Ireland Ltd (the controllers, both now Meta) regarding alleged illegal processing of data, including special categories of data. The alleged infringements pertained to the processing activities on the services Facebook, Instagram and WhatsApp. Given the cross-border nature of the processing and the establishment of Meta in Ireland, the Irish DPA (DPC) was the lead DPA responsible for handling those complaints, Article 56(1) GDPR. Following the DPC's three investigations, it submitted to the other concerned DPAs three draft decisions pursuant to Article 60(3) GDPR. In these draft decisions, the DPC considered, inter alia, that the data subjects had failed to demonstrate that the controllers could not rely on Article 6(1)(b) GDPR. Several of the other concerned DPAs objected to the DPC’s assessments and after failing to reach a consensus between the DPAs, the DPC submitted the matter to the EDPB according to the consistency mechanism established in Article 60(4) GDPR. The EDPB adopted Binding Decisions 3/2022, 4/2022 and 5/2022 on 5 December 2022 under Article 65(1)(a) GDPR. Finding most of the objections to the DPC’s draft decisions were relevant and reasoned, within the meaning of Article 4(24) GDPR the EDPB did not follow the DPC's analysis that the controllers could, a priori, rely on Article 6(1)(b) GDPR. Therefore, it demanded that the DPC exclude from its final decisions the finding that it was not necessary to have the users’ consent for the data processing carried out. By contrast the EDPB required the DPC to find in its three final decisions certain infringements GDPR, in particular of Article 6(1) GDPR, and to adopt corrective measures in respect of the controllers. Furthermore the EDPB found the scope of the investigation and analyses by the DPC excessively narrow. Thus, the EDPB instructed the DPC firstly to carry out a new investigation in order to determine, whether the processing operations carried out by the controllers in the context of its Facebook, Instagram and WhatsApp sevices relate to special categories of personal data, within the meaning of Article 9 GDPR. The DPC must also assess whether the processing is used for targeted advertising, marketing or otherwise for the purpose of improving the service, and if WhatsApp complies in that regard with the GDPR obligations. Secondly the EDPB ordered the DPC to issue a new draft decision under Article 60(3) GDPR. The DPC disputed the EDPB’s power to impose such measures, alleging that the EDPB exceeded the competence conferred on it by Article 65(1)(a) GDPR because primarily this provision cannot be interpreted to permit Binding Decisions regarding the scope of a lead DPA's investigation and decision. = The court found the DPC's challenge admissable, arguing that the DPC could just seek the annulment of the binding decisions. It therefore dismissed the EDPB's argument, that because the DPC only disputed the EDPB's instructions not the DPAs objections as being relevant and reasoned within the meaning of Article 4(24) GDPR its competence could not be questioned following Article 65(1)(a) GDPR. The court held, that the classification of the objections only constitutes the grounds of a legal act and are not in themselves capable of forming the subject of an action for annulment, as they do not produce legal effects. Therefore it was sufficient, the court held, that the DPC expressly disputes the EDPB’s interpretation of Article 4(24) GDPR concerning the concept of ‘relevant and reasoned objection’ without formally seeking their "annulment". The court also affirmed the DPC's interest in having the contested instructions annulled. Although the DPC did not dispute its obligation to reassess whether Meta needs the consent of users and reexamine the case, the court held, that this does not in itself imply the EDPB's power to impose such measures by binding decision = The court held, that the wording of Article 65(1)(a) GDPR, Article 65(6) GDPR and Article 4(24) GDPR and Recitals 126 and 136 GDPR does not limit the scope of an EDPB binding decision regarding objections to the considerations set out in the draft decision. Consequently, if it appears that the case file is insufficient for the purpose of carrying out the required analysis in full, the EDPB must be able to require the lead DPA to undertake further investigation. The court held, that Article 65(6) GDPR - which requires final decisions to refer to the lead DPA's decision - does not defines the the scope or the legal effect of a binding decision on the basis of Article 65(1)(a) GDPR; this provision only specifies the rules for the adoption of final decisions of the competent DPAs where those decisions may be adopted immediately on the basis of an EDPB binding decision. This, the court stated cannot be invalidated by the wording of Recitals 126 and 136 GDPR as they relate purely to procedural matters. The court held, that the scope of the investigation is not a procedural matter as it relates to the substance of the case, since it determines what must be examined in order to assess whether the processing at issue complies with the GDPR. The court also dismissed the DPC's argument that this interpretation enables the EDPB to completely direct the lead DPA whenever a question raised by a DPA concerned is classified as a relevant and reasoned objection. The court stated, that such objections may only relate to questions of substantial GDPR compliance not to the conduct of the investigation itself (as opposed to the scope of the investigation). The court held, that contrary to the DPC's contextual argument, that the short deadlines provided in Article 60(5) and (6) GDPR suggest that a revised draft decision cannot include major amendments. The court found, that these Articles cannot be applied where a new investigation is needed but only where the draft decision can immediately be amended. Additionally, the court stated, that the cooperation procedure between DPAs, described in Article 60 GDPR cannot be seen as a ‘one-way’ procedure in which the stages always follow in the order of the provisions providing for them. The court also dismissed the DPC's argument that read in the light of Recital 141 GDPR, Article 57(1)(f) GDPR demonstrates that the scope of the investigation following a complaint is within the discretion of the national DPA subject only to national judicial review. The court held, that the EDPB's review powers do not undermine the DPA's task to handle complaints and the possibility of judicial review of interim DPA decision by national courts does not prevent the draft decision of the lead DPA from itself being subject to review by the EDPB. The DPC submits that recognising the EDPB's power to direct a lead DPA to issue a new draft decision and broaden the scope of its investigation beforehand is not consistent with the purpose of the ‘one-stop-shop’ mechanism. However, the court rebuts this argument, by holding that procedural simplification cannot take precedence over the essential objective of the GDPR to ensure the protection of personal data. Furthermore, the negative effects of more complicated procedures for the persons concerned could be avoided if the lead DPA carries out an appropriate investigation and analysis from the outset. Insofar as the DPC argues referring to Article 58(4) and Recital 141 GDPR that disagreement between DPAs is to be resolved through judicial review in the national courts, the court held, that this cannot mean that persistent disagreements between the DPAs cannot be resolved within the EDPB, as the GDPR establishes the framework of the cooperation mechanism between DPAs exactly for that purpose. = The court held that the EDPB's power is exercised only in the event of a clearly identified shortcoming by the lead DPA and that that power results from the collective assessment of the DPAs comprising the EDPB. The court held that following the above analysis of Article 65 GDPR there is no doubt that the EDPB has the contested competence and therefore that it is expressly provided for by the legislature. While the court agreed, with the DPC that the exercise of the EDPB’s power is subject to judicial review it maintained its own ability to examine the legality of the very substance of the binding decisions giving instructions to the DPAs based on the EU legislature's decision that persistent disagreements between DPAs should be arbitrated in the context of the consistency mechanism within the EDPB. The court also stated, that an EDPB binding decision does not call into question a DPA's ability to prioritise the performance of its various tasks as an independent authority - which is for the national court alone to review - as it only provides binding decisions in exceptional cases. Therefore, the court found, that contrary to the DPC's assesment, the EDPB's powers are in line with the ‘Meroni doctrine’, stating that the principles of EU law require powers to be precisely delineated and amenable to judicial review.